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REMARKS: 

This paper is herewith filed in response to the Examiner's final Office Action mailed on June 1 2, 
2009 for the above-captioned U.S. Patent Application. This office action is a final rejection of 
claims 1-19, 21, 27, and 29-51 of the application. 

More specifically, the Examiner has rejected claims 50 and 51 imder 35 USC 112, first 
paragraph, as allegedly failing to comply with the written description; rejected claims 1,3-4, 6- 
14, 16-17, 21, 27, 29-34, 36-38, 40, 42-43, 46-47, and 50-51 under 35 USC 103(a) as being 
unpatentable over Chavez (US6,591,102) in view of Lamb (US6,085,083), and in further of Bui 
(US6,4 12,007); rejected claims 2, 5, 33, 39, 44, and 48 under 35 USC 103(a) as being 
unpatentable over the combination of Chavez and Lamb, in view of Bui, and further in view of 
Henry (US6,8 56,800); rejected claim 19 under 35 USC 103(a) as being impatentable over the 
combination of Chavez and Lamb, in view of Bui, and further in view of Wright (US6,957,061); 
and rejected claims 1 5, 35, 41 , 45, and 49 under 35 USC 1 03(a) as being unpatentable over the 
combination of Chavez and Lamb, in view of Bui, and further in view of Basilier (US6,728,536). 
The Applicant respectfully traverses the rejection. 

Claims 1-9, 1 1-19, 21, 27, 29-31, 35, 37, 41-42, 45-46, and 49-51 have been amended. Claims 
13, 27, 33, 36, 39, 44, and 48 have been cancelled. Support for the amendments can be found at 
least in paragraphs [0040] and [0041] of the published application. No new matter is added. 

In regards to the rejection of claims 50 and 51 under 35 USC 112, first paragraph, the Applicant 
disagrees with the rejection. Further, the Applicant notes that claims 50 and 51 have been 
amended for clarification. 

The Applicant notes that claims 50 and 51 were rejected under 35 U.S.C. §112, first paragraph, 
as failing to comply with the written description requirement. In particular, the Office Action 
asserted that the limitation "a computer program, embodied on a computer-readable medium, 
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configured to control a processor" does not appear to be disclosed in the disclosure. However, 
Applicant respectfully reasserts the arguments in the prior Response to Office Action filed on 
March 24, 2009. 

The Applicant again submits that in the Office Action the Examiner has improperly rejected 
claims 50 and 51 under the first paragraph of 35 U.S.C. § 1 12. 

As similarly stated in the the prior Response to Office Action filed on March 24, 2009, according 
to MPEP § 2163.04(1), the Examiner must: 

(A) Identify the claim limitation(s) at issue; and 

(B) Establish a prima facie case by providing reasons why a person skilled in the art at the time 
the application was filed would not have recognized that the inventor was in possession of the 
invention as claimed in view of the disclosvire of the application as filed. 

In the instant case, the Office Action has not satisfied at least element B of the requirement set 
forth in MPEP §2163. 04(1) . In particular, the Office Action merely asserted that the specification 
does appear not disclose a computer program, embodied on a computer-readable medium, 
configured to control a processor. In other words, the Office Action has merely presented 2in 
insufficient conclusory statement to improperly reject claims 50 and 51. 

Furthermore, the Office Action does not provide reasons why a person skilled in the art would 
not have recognized that the inventor was in possession of the invention as claimed in view of the 
disclosure as filed. The Applicant contends that the Office Action cannot provide such reasons, 
for at least the reason that the specification clearly describes "network" operations and "server" 
devices for performing the exemplary embodiments of the invention (see at least paragraphs 
[0041] and [0043] to [0046). Moreover, the Applicant submits that with regards to a mobile 
station, which can be seen to interface with these devices, the specification clearly describes the " 
mobile station is illustrated cut away (as shown by phantom line 608) to reveal a data storage unit 
610 controlled via processor and control means 612 " (emphasis added) (paragraph [0049] of the 
published application). In addition, the specification continues to state " Once the profile is 
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downloaded to the P-CSCF or S-CSCF the AAA-H does not need to be contacted in every 
registration or session initiation"(emphasis added) (par. [0041] of the published application). 
Clearly, a person of ordinary skill in the art would understand that operations on these devices 
can be, at least in part, the result of a computer-readable storage medium embodying a computer 
program, as in claims 50 and 5 1 . 

Therefore, in view of the above, a person of ordinary skill in the art would readily appreciate that 
a " computer-readable storage medium embodying a computer program..." (claims 50 and 51) is 
supported in the specification through above-cited disclosure. Applicants note that MPEP § 
2163(I)(B) does not require in haec verba, but instead requires that the limitations added be 
supported in the specification through express, word-for-word, or inherent disclosure (emphasis 
added). Because the MPEP does not require explicit support in the specification, the implicit 
disclosure of "computer-readable storage medium embodying a computer program " satisfies the 
written description requirement under the first paragraph oG5 U.S.C. § 112. Accordingly, 
AppHcant respectfiiUy requests that the rejection of claims 50 and 5 1 be removed for at least the 
reasons stated above. 



Regarding the rejection of claim 1 the Applicant notes that claim 1 has been amended to recite: 

A method, comprising: using an authorization and authentication profile 
associated with a user, including the authorization and authentication profile is 
sent fi-om an authentication and authorization device located in a home network 
to a server node; and the authorization and authentication profile is stored at the 
server node, wherein the authorization and authentication profile contains 
information which allows the server node to authorize and authenticate the user 
directly without contacting the authentication and authorization device, and 
wherein the authorization and authentication profile further contains information 
defining that the authentication and authorization device is to be contacted when 
a number of simultaneous sessions for the user is equal to a predetermined 
number. 

The Applicant notes that the amendments are supported at least in paragraphs [0041] to [0043] of 
the published application. 
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In the Office Action the Examiner admits: 



"However, Chavez et al., as modified by Lamb, fail to specifically disclose 
authorization is verified when the number of simultaneous session is equal to a 
predetermined number," (emphasis added); and 

"In the same field of endeavor, Bui et al. clearly show and disclose after 
determining the number of sessions that are currently established for a particular 
entity, the local DSC compares the number to a session threshold value , wherein 
the threshold identifies the maximum number of session allowed before SLOW 
LANE authorization is required, reading on the claimed "authorization and 
authentication for the user is verified when the number of simultaneous session is 
equal to a predetermined number," (5 lines 36-50, coL 5 line 60- col. 6 line 8, col. 
6 lines 12-22)," (emphasis added); and 

"Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to perform an authentication after the number of 
currently established sessions reaches a maximum as taught by Bui et al. in the 
method of Chavez et al., as modified by Lamb, in order to control authorization 
and access to a system and/or its services," 



Firstly, although the Applicant does not expressly or impliedly agree with the rejections in the 
Office Action, the Applicant submits that the proposed combination is clearly improper. 

It is noted that, in Bui, a session threshold value is assigned to entities and one or more of the 
entities are associated with a particular user. The entities associated with the user are also 
assigned to an authoritative DSC. (col. 23, lines 2-9). As cited by the Examiner, Bui discloses 
that when a client sends a request to a network access server requesting that a connection be 
established for accessing a network system, the network access server then sends an authorization 
request message to a local DSC (coL 5, lines 36-42). The local DSC then determines whether a 
number of established sessions exceed a local threshold value that identifies a maximum number 
of sessions that may be established for a particular entity. If the established sessions exceed this 
value the local DSC cannot authorize the connection request and the local DSC must send an 
additional authorization request to the authoritative DSC (col. 6, lines 12-25). 
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Chavez relates to a system which is intended to reduce transmissions in a wireless network. 
According to Chavez, ^^ Authentication information is only transmitted to the base station when a 
request for a wireless service is requested for the wireless handset," (emphasis added), (col. 2, 
lines 7-9). In Chavez, if authentication information is not stored in the memory of a base station, 
which receives a request from a mobile station for service, the base station transmits a request to 
a mobile switching station for the authentication information (col. 2, lines 38-46). 

The Applicant contends that a person of ordinary skill in the art would not be motivated to 
combine Chavez and Bui for at least the reason that such a modification would result in the base 
station of Chavez requesting authentication information from the mobile switching station only if 
the established sessions exceed a local threshold value. Clearly, this can be seen to make Chavez 
inoperable for its intended purposes. Moreover, with such a limitation, Chavez certainly could 
not be seen to disclose or suggest the exemplary embodiments of the invention as recited in claim 
1. 

Further, the Applicant contends that a person of ordinary skill in the art would not be motivated 
to combine Chavez and Bui for at least the reason that to include such information relating to a 
local threshold, as in Bui, in the authentication information, of Chavez, would clearly go against 
the teachings of Chavez. This is seen to be the case for at least the reason that the added 
information would certainly increase the amount of traffic in the network of Chavez. 

The Applicant contends that, for at least these reasons the proposed combination is seen to be 
improper and the rejection of claim 1 should be removed. 

In addition, the Applicant submits that there can not be found in any of the references cited, 
alone or combined, where it can be seen to be disclosed or suggested that an authorization and 
authentication profile is sent from an authentication and authorization device located in a home 
network of the user to a server node, wherein the authorization and authentication profile 
contains information which allows the server node to authorize and authenticate the user directlv 
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without contacting the authentication and authorization device, and wherein the authorization and 
authentication profile further contains information defining that the authentication and 
authorization device is to be contacted when a number of simultaneous sessions for the user is 
equal to a predetermined number . 

The Applicant submits that the local threshold value in Bui can not be seen to relate to an 
authorization and authentication profile sent fi'om an authentication and authorization device , as 
in claim 1 . 

The Applicants submit that this is seen to be the case for at least the reason that there can not be 
foimd anything in Bui to indicate that the local session threshold information is received in an 
authorization and authentication profile sent to the local DSC. Rather, in Bui, it appears that the 
local session threshold is maintained in a connection data storage area. The Applicant can not 
find in all of Bui anj^ihing which can be seen to disclose or suggest that the local session 
threshold is sent firom an authentication and authorization device to a local DSC of Bui. 

Bui discloses: 

"At state 1 2, the network access server 408 communicates with local DSC 412 to 
request authorization to establish another session for COMPANY A. Upon 
receivinig the authorization request, at state 13. local DSC 412 interfaces with 
connection data storage area 418 to determine the values of local session 
threshold variable 432 , local session counter variable 434, and authoritative DSC 
variable 436," ( emphasis added), (col. 15, lines 33-40 and Fig. 4). 

In Bui, upon receiving the authorization request, the local session threshold value is retrieved by 
the local DSC by interfacing with the connection data storage area. The Applicant submits that 
there can not be fovmd in all of Bui where it is disclosed or suggested that an authorization and 
authentication profile [is] sent fi-om an authentication and authorization device , wherein the 
authorization and authentication profile further contains information defining that the 
authentication and authorization device is to be contacted when a number of simultaneous 
sessions for the user is equal to a predetermined number, as in claim 1 . 
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Thus, for at least these reasons, the Applicant contend that Bui can not be seen to disclose or 
suggest at least where claim 1 relates to an authorization and authentication profile sent from an 
authentication and authorization device , wherein the authorization and authentication profile 
further contains information defining that the authentication and authorization device is to be 
contacted when a number of simultaneous sessions for the user is equal to a predetermined 
number. 

Further, the Applicant submits that neither Chavez nor Lamb disclose or suggest any operation 
including "an authorization and authentication profile associated with a user ," as in claim 1 . The 
Applicant contends that Chavez relates to authentication of a handset (col. 1, line 55). Lamb is 
seen to relate to determining if authentication processing of a subscribers cellular phone and 
fraud processing capabilities related to the cellular phone (abstract). 

The Applicant contends that, for at least the reasons stated, even if the references were combined, 
which is not agreed to as proper, the combination would still fail to disclose or suggest claim 1 . 
Thus, the rejection of claim 1 is seen to be improper and the rejection should be removed. 

Further, for at least the reason that independent claims 7, 2 1 , 29, 30, 3 1 , 42, 46, 50, and 5 1 recite 
features similar to claim 1, as stated above, the rejections of these claims is seen to be improper 
and the rejections should be removed. 

Furthermore, as the claims 2-6, claims 8-12 and 14-19, claims 32 and 34-35, claims 37-38 and 
40, claims 43 and 45, and claims 47 and 49 depend from claims 1, 7, 30, 31, 42, and 46, 
respectively, the rejections of these claims is improper, and all the claims 1-12, 14-19, 21-27, 29- 
32, 34-35, 37-38, 40-43, 45-47, and 49-51 should be allowed. 

Based on the above explanations and arguments, it is clear that the references cited cannot be 
seen to disclose or suggest claims 1-12, 14-19, 21-26, 29-32, 34-35, 37-38, 40-43, 45-47, and 49- 
51. The Examiner is respectfully requested to reconsider and remove the rejections of and to 
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allow all of the pending as now presented for examination. 

For all of the foregoing reasons, it is respectfully submitted that all of the claims now present in 
the application are clearly novel and patentable over the prior art of record. Should any 
unresolved issue remain, the Examiner is invited to call Applicants' attomey at the telephone 
number indicated below. 

Respectfully submitted: 




Customer No.: 29683 
HARRINGTON & SMITH, PC 
4 Research Drive 
Shelton, CT 06484-6212 
Telephone: (203)925-9400 
Facsimile: (203)944-0245 
email: j garritvtglhspatent.com 
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